2014-08-01 17:34:06 +00:00
package main
import (
2017-04-02 22:21:56 +00:00
"context"
2015-05-07 16:49:07 +00:00
"crypto/tls"
2015-01-22 00:55:05 +00:00
"fmt"
2020-07-28 23:01:08 +00:00
"net"
2015-01-22 00:55:05 +00:00
"os"
"path/filepath"
2017-12-08 23:13:43 +00:00
"runtime"
2015-05-05 04:18:28 +00:00
"strings"
2015-04-27 21:11:29 +00:00
"time"
2015-01-22 00:55:05 +00:00
2018-09-21 22:58:34 +00:00
containerddefaults "github.com/containerd/containerd/defaults"
2016-04-08 23:22:39 +00:00
"github.com/docker/docker/api"
2015-04-16 19:48:04 +00:00
apiserver "github.com/docker/docker/api/server"
2017-04-13 18:37:32 +00:00
buildbackend "github.com/docker/docker/api/server/backend/build"
2016-04-08 23:22:39 +00:00
"github.com/docker/docker/api/server/middleware"
Remove static errors from errors package.
Moving all strings to the errors package wasn't a good idea after all.
Our custom implementation of Go errors predates everything that's nice
and good about working with errors in Go. Take as an example what we
have to do to get an error message:
```go
func GetErrorMessage(err error) string {
switch err.(type) {
case errcode.Error:
e, _ := err.(errcode.Error)
return e.Message
case errcode.ErrorCode:
ec, _ := err.(errcode.ErrorCode)
return ec.Message()
default:
return err.Error()
}
}
```
This goes against every good practice for Go development. The language already provides a simple, intuitive and standard way to get error messages, that is calling the `Error()` method from an error. Reinventing the error interface is a mistake.
Our custom implementation also makes very hard to reason about errors, another nice thing about Go. I found several (>10) error declarations that we don't use anywhere. This is a clear sign about how little we know about the errors we return. I also found several error usages where the number of arguments was different than the parameters declared in the error, another clear example of how difficult is to reason about errors.
Moreover, our custom implementation didn't really make easier for people to return custom HTTP status code depending on the errors. Again, it's hard to reason about when to set custom codes and how. Take an example what we have to do to extract the message and status code from an error before returning a response from the API:
```go
switch err.(type) {
case errcode.ErrorCode:
daError, _ := err.(errcode.ErrorCode)
statusCode = daError.Descriptor().HTTPStatusCode
errMsg = daError.Message()
case errcode.Error:
// For reference, if you're looking for a particular error
// then you can do something like :
// import ( derr "github.com/docker/docker/errors" )
// if daError.ErrorCode() == derr.ErrorCodeNoSuchContainer { ... }
daError, _ := err.(errcode.Error)
statusCode = daError.ErrorCode().Descriptor().HTTPStatusCode
errMsg = daError.Message
default:
// This part of will be removed once we've
// converted everything over to use the errcode package
// FIXME: this is brittle and should not be necessary.
// If we need to differentiate between different possible error types,
// we should create appropriate error types with clearly defined meaning
errStr := strings.ToLower(err.Error())
for keyword, status := range map[string]int{
"not found": http.StatusNotFound,
"no such": http.StatusNotFound,
"bad parameter": http.StatusBadRequest,
"conflict": http.StatusConflict,
"impossible": http.StatusNotAcceptable,
"wrong login/password": http.StatusUnauthorized,
"hasn't been activated": http.StatusForbidden,
} {
if strings.Contains(errStr, keyword) {
statusCode = status
break
}
}
}
```
You can notice two things in that code:
1. We have to explain how errors work, because our implementation goes against how easy to use Go errors are.
2. At no moment we arrived to remove that `switch` statement that was the original reason to use our custom implementation.
This change removes all our status errors from the errors package and puts them back in their specific contexts.
IT puts the messages back with their contexts. That way, we know right away when errors used and how to generate their messages.
It uses custom interfaces to reason about errors. Errors that need to response with a custom status code MUST implementent this simple interface:
```go
type errorWithStatus interface {
HTTPErrorStatusCode() int
}
```
This interface is very straightforward to implement. It also preserves Go errors real behavior, getting the message is as simple as using the `Error()` method.
I included helper functions to generate errors that use custom status code in `errors/errors.go`.
By doing this, we remove the hard dependency we have eeverywhere to our custom errors package. Yes, you can use it as a helper to generate error, but it's still very easy to generate errors without it.
Please, read this fantastic blog post about errors in Go: http://dave.cheney.net/2014/12/24/inspecting-errors
Signed-off-by: David Calavera <david.calavera@gmail.com>
2016-02-25 15:53:35 +00:00
"github.com/docker/docker/api/server/router"
2016-02-10 20:16:59 +00:00
"github.com/docker/docker/api/server/router/build"
2016-11-17 01:58:06 +00:00
checkpointrouter "github.com/docker/docker/api/server/router/checkpoint"
2016-02-10 20:16:59 +00:00
"github.com/docker/docker/api/server/router/container"
2017-05-01 23:17:35 +00:00
distributionrouter "github.com/docker/docker/api/server/router/distribution"
2019-04-02 04:08:51 +00:00
grpcrouter "github.com/docker/docker/api/server/router/grpc"
2016-02-10 20:16:59 +00:00
"github.com/docker/docker/api/server/router/image"
"github.com/docker/docker/api/server/router/network"
2016-11-10 01:49:09 +00:00
pluginrouter "github.com/docker/docker/api/server/router/plugin"
2017-05-15 19:59:15 +00:00
sessionrouter "github.com/docker/docker/api/server/router/session"
2016-06-14 02:52:49 +00:00
swarmrouter "github.com/docker/docker/api/server/router/swarm"
2016-02-10 20:16:59 +00:00
systemrouter "github.com/docker/docker/api/server/router/system"
"github.com/docker/docker/api/server/router/volume"
2018-04-17 22:50:17 +00:00
buildkit "github.com/docker/docker/builder/builder-next"
2017-05-15 21:54:27 +00:00
"github.com/docker/docker/builder/dockerfile"
2016-12-12 08:33:58 +00:00
"github.com/docker/docker/cli/debug"
2021-07-15 16:08:17 +00:00
"github.com/docker/docker/cmd/dockerd/trap"
2014-08-08 09:12:39 +00:00
"github.com/docker/docker/daemon"
2016-06-14 02:52:49 +00:00
"github.com/docker/docker/daemon/cluster"
2017-01-23 11:23:07 +00:00
"github.com/docker/docker/daemon/config"
2017-08-08 16:14:04 +00:00
"github.com/docker/docker/daemon/listeners"
2015-11-09 18:32:46 +00:00
"github.com/docker/docker/dockerversion"
2018-05-23 19:15:21 +00:00
"github.com/docker/docker/libcontainerd/supervisor"
2016-06-21 20:42:47 +00:00
dopts "github.com/docker/docker/opts"
2016-04-08 23:22:39 +00:00
"github.com/docker/docker/pkg/authorization"
2018-10-15 07:52:53 +00:00
"github.com/docker/docker/pkg/homedir"
2017-09-22 18:40:10 +00:00
"github.com/docker/docker/pkg/jsonmessage"
2015-04-27 21:11:29 +00:00
"github.com/docker/docker/pkg/pidfile"
2016-10-31 20:14:00 +00:00
"github.com/docker/docker/pkg/plugingetter"
2020-03-10 12:09:25 +00:00
"github.com/docker/docker/pkg/sysinfo"
2017-04-24 17:28:21 +00:00
"github.com/docker/docker/pkg/system"
2017-03-17 21:57:23 +00:00
"github.com/docker/docker/plugin"
2018-10-15 07:52:53 +00:00
"github.com/docker/docker/rootless"
2016-03-28 18:22:23 +00:00
"github.com/docker/docker/runconfig"
2015-12-30 00:27:12 +00:00
"github.com/docker/go-connections/tlsconfig"
2017-04-02 22:21:56 +00:00
swarmapi "github.com/docker/swarmkit/api"
2017-07-28 23:04:34 +00:00
"github.com/moby/buildkit/session"
2017-05-15 19:59:15 +00:00
"github.com/pkg/errors"
2017-07-26 21:42:13 +00:00
"github.com/sirupsen/logrus"
2016-06-21 20:42:47 +00:00
"github.com/spf13/pflag"
2014-08-01 17:34:06 +00:00
)
2015-12-10 23:35:10 +00:00
// DaemonCli represents the daemon CLI.
type DaemonCli struct {
2017-01-23 11:23:07 +00:00
* config . Config
2016-06-21 20:42:47 +00:00
configFile * string
flags * pflag . FlagSet
2016-04-23 00:16:14 +00:00
2016-05-16 18:12:48 +00:00
api * apiserver . Server
d * daemon . Daemon
authzMiddleware * authorization . Middleware // authzMiddleware enables to dynamically reload the authorization plugins
2015-12-10 23:35:10 +00:00
}
2016-06-21 20:42:47 +00:00
// NewDaemonCli returns a daemon CLI
2015-05-05 04:18:28 +00:00
func NewDaemonCli ( ) * DaemonCli {
2016-06-21 20:42:47 +00:00
return & DaemonCli { }
2014-08-10 01:18:32 +00:00
}
2017-06-01 20:34:31 +00:00
func ( cli * DaemonCli ) start ( opts * daemonOptions ) ( err error ) {
opts . SetDefaultOptions ( opts . flags )
2015-05-05 04:18:28 +00:00
2016-06-21 20:42:47 +00:00
if cli . Config , err = loadDaemonCliConfig ( opts ) ; err != nil {
2016-04-23 00:16:14 +00:00
return err
2015-12-10 23:35:10 +00:00
}
2021-12-15 22:51:57 +00:00
if err := checkDeprecatedOptions ( cli . Config ) ; err != nil {
return err
}
2018-11-05 00:52:26 +00:00
if opts . Validate {
// If config wasn't OK we wouldn't have made it this far.
fmt . Fprintln ( os . Stderr , "configuration OK" )
return nil
}
2021-07-16 07:33:00 +00:00
configureProxyEnv ( cli . Config )
2018-11-24 13:39:08 +00:00
if err := configureDaemonLogs ( cli . Config ) ; err != nil {
return err
}
2019-04-19 16:06:59 +00:00
logrus . Info ( "Starting up" )
2016-06-21 20:42:47 +00:00
cli . configFile = & opts . configFile
cli . flags = opts . flags
2015-12-10 23:35:10 +00:00
if cli . Config . Debug {
2016-12-12 08:33:58 +00:00
debug . Enable ( )
2015-12-10 23:35:10 +00:00
}
2015-05-21 17:48:36 +00:00
2016-10-06 14:09:54 +00:00
if cli . Config . Experimental {
2015-05-05 04:18:28 +00:00
logrus . Warn ( "Running experimental build" )
2020-03-10 02:36:30 +00:00
}
if cli . Config . IsRootless ( ) {
logrus . Warn ( "Running in rootless mode. This mode has feature limitations." )
}
if rootless . RunningWithRootlessKit ( ) {
logrus . Info ( "Running with RootlessKit integration" )
if ! cli . Config . IsRootless ( ) {
return fmt . Errorf ( "rootless mode needs to be enabled for running with RootlessKit" )
2018-10-15 07:52:53 +00:00
}
}
2020-03-10 02:36:30 +00:00
2018-10-15 07:52:53 +00:00
// return human-friendly error before creating files
if runtime . GOOS == "linux" && os . Geteuid ( ) != 0 {
2021-08-27 05:08:03 +00:00
return fmt . Errorf ( "dockerd needs to be started with root privileges. To run dockerd in rootless mode as an unprivileged user, see https://docs.docker.com/go/rootless/" )
2014-08-01 17:34:06 +00:00
}
2015-03-28 01:38:00 +00:00
2015-06-15 13:36:19 +00:00
if err := setDefaultUmask ( ) ; err != nil {
2018-08-22 14:00:22 +00:00
return err
2015-06-15 13:36:19 +00:00
}
2016-11-04 19:42:21 +00:00
// Create the daemon root before we create ANY other files (PID, or migrate keys)
// to ensure the appropriate ACL is set (particularly relevant on Windows)
if err := daemon . CreateDaemonRoot ( cli . Config ) ; err != nil {
return err
}
2019-08-08 09:51:00 +00:00
if err := system . MkdirAll ( cli . Config . ExecRoot , 0700 ) ; err != nil {
2018-05-23 19:15:21 +00:00
return err
}
2018-10-15 07:52:53 +00:00
potentiallyUnderRuntimeDir := [ ] string { cli . Config . ExecRoot }
2015-05-05 04:18:28 +00:00
if cli . Pidfile != "" {
pf , err := pidfile . New ( cli . Pidfile )
2015-04-27 21:11:29 +00:00
if err != nil {
2018-08-22 14:00:22 +00:00
return errors . Wrap ( err , "failed to start daemon" )
2015-04-27 21:11:29 +00:00
}
2018-10-15 07:52:53 +00:00
potentiallyUnderRuntimeDir = append ( potentiallyUnderRuntimeDir , cli . Pidfile )
2015-04-27 21:11:29 +00:00
defer func ( ) {
2016-04-23 00:16:14 +00:00
if err := pf . Remove ( ) ; err != nil {
2015-04-27 21:11:29 +00:00
logrus . Error ( err )
}
} ( )
}
2014-08-20 15:31:24 +00:00
2019-02-14 03:48:41 +00:00
if cli . Config . IsRootless ( ) {
// Set sticky bit if XDG_RUNTIME_DIR is set && the file is actually under XDG_RUNTIME_DIR
if _ , err := homedir . StickRuntimeDirContents ( potentiallyUnderRuntimeDir ) ; err != nil {
// StickRuntimeDirContents returns nil error if XDG_RUNTIME_DIR is just unset
logrus . WithError ( err ) . Warn ( "cannot set sticky bit on files under XDG_RUNTIME_DIR" )
}
2018-10-15 07:52:53 +00:00
}
2018-04-12 18:44:20 +00:00
serverConfig , err := newAPIServerConfig ( cli )
if err != nil {
2018-08-22 14:00:22 +00:00
return errors . Wrap ( err , "failed to create API server" )
2015-10-12 08:49:25 +00:00
}
2017-06-12 21:50:29 +00:00
cli . api = apiserver . New ( serverConfig )
2016-02-11 18:30:23 +00:00
2018-04-12 18:44:20 +00:00
hosts , err := loadListeners ( cli , serverConfig )
if err != nil {
2018-08-22 14:00:22 +00:00
return errors . Wrap ( err , "failed to load listeners" )
2015-10-05 16:32:08 +00:00
}
2015-04-16 19:48:04 +00:00
2018-05-23 19:15:21 +00:00
ctx , cancel := context . WithCancel ( context . Background ( ) )
2019-04-08 09:44:14 +00:00
waitForContainerDShutdown , err := cli . initContainerD ( ctx )
if waitForContainerDShutdown != nil {
defer waitForContainerDShutdown ( 10 * time . Second )
}
if err != nil {
Windows: Experimental: Allow containerd for runtime
Signed-off-by: John Howard <jhoward@microsoft.com>
This is the first step in refactoring moby (dockerd) to use containerd on Windows.
Similar to the current model in Linux, this adds the option to enable it for runtime.
It does not switch the graphdriver to containerd snapshotters.
- Refactors libcontainerd to a series of subpackages so that either a
"local" containerd (1) or a "remote" (2) containerd can be loaded as opposed
to conditional compile as "local" for Windows and "remote" for Linux.
- Updates libcontainerd such that Windows has an option to allow the use of a
"remote" containerd. Here, it communicates over a named pipe using GRPC.
This is currently guarded behind the experimental flag, an environment variable,
and the providing of a pipename to connect to containerd.
- Infrastructure pieces such as under pkg/system to have helper functions for
determining whether containerd is being used.
(1) "local" containerd is what the daemon on Windows has used since inception.
It's not really containerd at all - it's simply local invocation of HCS APIs
directly in-process from the daemon through the Microsoft/hcsshim library.
(2) "remote" containerd is what docker on Linux uses for it's runtime. It means
that there is a separate containerd service running, and docker communicates over
GRPC to it.
To try this out, you will need to start with something like the following:
Window 1:
containerd --log-level debug
Window 2:
$env:DOCKER_WINDOWS_CONTAINERD=1
dockerd --experimental -D --containerd \\.\pipe\containerd-containerd
You will need the following binary from github.com/containerd/containerd in your path:
- containerd.exe
You will need the following binaries from github.com/Microsoft/hcsshim in your path:
- runhcs.exe
- containerd-shim-runhcs-v1.exe
For LCOW, it will require and initrd.img and kernel in `C:\Program Files\Linux Containers`.
This is no different to the current requirements. However, you may need updated binaries,
particularly initrd.img built from Microsoft/opengcs as (at the time of writing), Linuxkit
binaries are somewhat out of date.
Note that containerd and hcsshim for HCS v2 APIs do not yet support all the required
functionality needed for docker. This will come in time - this is a baby (although large)
step to migrating Docker on Windows to containerd.
Note that the HCS v2 APIs are only called on RS5+ builds. RS1..RS4 will still use
HCS v1 APIs as the v2 APIs were not fully developed enough on these builds to be usable.
This abstraction is done in HCSShim. (Referring specifically to runtime)
Note the LCOW graphdriver still uses HCS v1 APIs regardless.
Note also that this does not migrate docker to use containerd snapshotters
rather than graphdrivers. This needs to be done in conjunction with Linux also
doing the same switch.
2019-01-08 22:30:52 +00:00
cancel ( )
return err
2016-03-18 18:50:19 +00:00
}
2018-05-23 19:15:21 +00:00
defer cancel ( )
2018-11-05 00:52:26 +00:00
stopc := make ( chan bool )
defer close ( stopc )
2021-07-15 16:08:17 +00:00
trap . Trap ( func ( ) {
2016-06-13 06:10:37 +00:00
cli . stop ( )
<- stopc // wait for daemonCli.start() to return
2017-08-01 03:32:57 +00:00
} , logrus . StandardLogger ( ) )
2016-03-18 18:50:19 +00:00
2017-02-01 18:52:16 +00:00
// Notify that the API is active, but before daemon is set up.
2020-12-22 09:43:01 +00:00
preNotifyReady ( )
2017-02-01 18:52:16 +00:00
2017-03-17 21:57:23 +00:00
pluginStore := plugin . NewStore ( )
2017-06-12 21:50:29 +00:00
if err := cli . initMiddlewares ( cli . api , serverConfig , pluginStore ) ; err != nil {
2017-03-17 21:57:23 +00:00
logrus . Fatalf ( "Error creating middlewares: %v" , err )
}
2018-05-23 19:15:21 +00:00
d , err := daemon . NewDaemon ( ctx , cli . Config , pluginStore )
2015-05-07 22:35:12 +00:00
if err != nil {
2018-08-22 14:00:22 +00:00
return errors . Wrap ( err , "failed to start daemon" )
2015-05-07 22:35:12 +00:00
}
Don't create source directory while the daemon is being shutdown, fix #30348
If a container mount the socket the daemon is listening on into
container while the daemon is being shutdown, the socket will
not exist on the host, then daemon will assume it's a directory
and create it on the host, this will cause the daemon can't start
next time.
fix issue https://github.com/moby/moby/issues/30348
To reproduce this issue, you can add following code
```
--- a/daemon/oci_linux.go
+++ b/daemon/oci_linux.go
@@ -8,6 +8,7 @@ import (
"sort"
"strconv"
"strings"
+ "time"
"github.com/Sirupsen/logrus"
"github.com/docker/docker/container"
@@ -666,7 +667,8 @@ func (daemon *Daemon) createSpec(c *container.Container) (*libcontainerd.Spec, e
if err := daemon.setupIpcDirs(c); err != nil {
return nil, err
}
-
+ fmt.Printf("===please stop the daemon===\n")
+ time.Sleep(time.Second * 2)
ms, err := daemon.setupMounts(c)
if err != nil {
return nil, err
```
step1 run a container which has `--restart always` and `-v /var/run/docker.sock:/sock`
```
$ docker run -ti --restart always -v /var/run/docker.sock:/sock busybox
/ #
```
step2 exit the the container
```
/ # exit
```
and kill the daemon when you see
```
===please stop the daemon===
```
in the daemon log
The daemon can't restart again and fail with `can't create unix socket /var/run/docker.sock: is a directory`.
Signed-off-by: Lei Jitang <leijitang@huawei.com>
2017-05-22 07:44:01 +00:00
d . StoreHosts ( hosts )
2018-09-07 03:26:04 +00:00
// validate after NewDaemon has restored enabled plugins. Don't change order.
2017-03-17 21:57:23 +00:00
if err := validateAuthzPlugins ( cli . Config . AuthorizationPlugins , pluginStore ) ; err != nil {
2018-08-22 14:00:22 +00:00
return errors . Wrap ( err , "failed to validate authorization plugin" )
2017-03-17 21:57:23 +00:00
}
2019-09-11 11:40:11 +00:00
cli . d = d
2020-01-29 16:51:01 +00:00
if err := startMetricsServer ( cli . Config . MetricsAddress ) ; err != nil {
return errors . Wrap ( err , "failed to start metrics server" )
2016-07-20 23:11:28 +00:00
}
2018-04-12 18:44:20 +00:00
c , err := createAndStartCluster ( cli , d )
2017-04-30 21:51:43 +00:00
if err != nil {
logrus . Fatalf ( "Error starting cluster component: %v" , err )
}
2016-06-14 02:52:49 +00:00
2016-09-09 16:55:57 +00:00
// Restart all autostart containers which has a swarm endpoint
// and is not yet running now that we have successfully
// initialized the cluster.
d . RestartSwarmContainers ( )
2015-05-07 22:35:12 +00:00
logrus . Info ( "Daemon has completed initialization" )
2017-06-12 21:50:29 +00:00
routerOptions , err := newRouterOptions ( cli . Config , d )
if err != nil {
return err
}
routerOptions . api = cli . api
routerOptions . cluster = c
initRouter ( routerOptions )
2015-09-23 23:42:08 +00:00
2018-05-23 19:15:21 +00:00
go d . ProcessClusterNotifications ( ctx , c . GetWatchStream ( ) )
2017-04-02 22:21:56 +00:00
2016-04-23 00:16:14 +00:00
cli . setupConfigReloadTrap ( )
2015-12-10 23:35:10 +00:00
2015-11-25 02:17:37 +00:00
// The serve API routine never exits unless an error occurs
// We need to start it as a goroutine and wait on it so
// daemon doesn't exit
serveAPIWait := make ( chan error )
2017-06-12 21:50:29 +00:00
go cli . api . Wait ( serveAPIWait )
2015-11-25 02:17:37 +00:00
2015-11-25 19:05:31 +00:00
// after the daemon is done setting up we can notify systemd api
2020-12-22 09:43:01 +00:00
notifyReady ( )
2015-04-17 19:03:11 +00:00
2015-03-11 14:33:06 +00:00
// Daemon is fully initialized and handling API traffic
2015-04-27 21:11:29 +00:00
// Wait for serve API to complete
2015-03-11 14:33:06 +00:00
errAPI := <- serveAPIWait
2016-06-14 02:52:49 +00:00
c . Cleanup ( )
2018-05-23 19:15:21 +00:00
2020-12-22 09:43:01 +00:00
// notify systemd that we're shutting down
notifyStopping ( )
2016-06-07 03:29:05 +00:00
shutdownDaemon ( d )
2018-05-23 19:15:21 +00:00
// Stop notification processing and any background processes
cancel ( )
2015-03-11 14:33:06 +00:00
if errAPI != nil {
2018-08-22 14:00:22 +00:00
return errors . Wrap ( errAPI , "shutting down due to ServeAPI error" )
2016-04-23 00:16:14 +00:00
}
2019-04-19 16:06:59 +00:00
logrus . Info ( "Daemon shutdown complete" )
2016-04-23 00:16:14 +00:00
return nil
}
2017-06-12 21:50:29 +00:00
type routerOptions struct {
sessionManager * session . Manager
buildBackend * buildbackend . Backend
2018-08-22 06:05:26 +00:00
features * map [ string ] bool
2018-05-15 17:02:16 +00:00
buildkit * buildkit . Builder
2017-06-12 21:50:29 +00:00
daemon * daemon . Daemon
api * apiserver . Server
cluster * cluster . Cluster
}
2018-09-06 18:50:41 +00:00
func newRouterOptions ( config * config . Config , d * daemon . Daemon ) ( routerOptions , error ) {
2017-06-12 21:50:29 +00:00
opts := routerOptions { }
sm , err := session . NewManager ( )
if err != nil {
return opts , errors . Wrap ( err , "failed to create sessionmanager" )
}
2019-09-24 21:37:38 +00:00
manager , err := dockerfile . NewBuildManager ( d . BuilderBackend ( ) , d . IdentityMapping ( ) )
2017-06-12 21:50:29 +00:00
if err != nil {
return opts , err
}
2018-09-07 20:43:21 +00:00
cgroupParent := newCgroupParent ( config )
2018-08-06 01:52:35 +00:00
bk , err := buildkit . New ( buildkit . Opt {
2018-08-15 01:40:28 +00:00
SessionManager : sm ,
Root : filepath . Join ( config . Root , "buildkit" ) ,
2018-09-06 18:50:41 +00:00
Dist : d . DistributionServices ( ) ,
NetworkController : d . NetworkController ( ) ,
2018-08-15 01:40:28 +00:00
DefaultCgroupParent : cgroupParent ,
2020-04-14 03:31:26 +00:00
RegistryHosts : d . RegistryHosts ( ) ,
2018-09-05 02:12:44 +00:00
BuilderConfig : config . Builder ,
2019-02-28 08:12:55 +00:00
Rootless : d . Rootless ( ) ,
2019-06-10 23:28:01 +00:00
IdentityMapping : d . IdentityMapping ( ) ,
2019-06-06 01:36:33 +00:00
DNSConfig : config . DNSConfig ,
2020-10-09 17:20:48 +00:00
ApparmorProfile : daemon . DefaultApparmorProfile ( ) ,
2018-04-17 22:50:17 +00:00
} )
if err != nil {
return opts , err
}
API: add "prune" events
This patch adds a new "prune" event type to indicate that pruning of a resource
type completed.
This event-type can be used on systems that want to perform actions after
resources have been cleaned up. For example, Docker Desktop performs an fstrim
after resources are deleted (https://github.com/linuxkit/linuxkit/tree/v0.7/pkg/trim-after-delete).
While the current (remove, destroy) events can provide information on _most_
resources, there is currently no event triggered after the BuildKit build-cache
is cleaned.
Prune events have a `reclaimed` attribute, indicating the amount of space that
was reclaimed (in bytes). The attribute can be used, for example, to use as a
threshold for performing fstrim actions. Reclaimed space for `network` events
will always be 0, but the field is added to be consistent with prune events for
other resources.
To test this patch:
Create some resources:
for i in foo bar baz; do \
docker network create network_$i \
&& docker volume create volume_$i \
&& docker run -d --name container_$i -v volume_$i:/volume busybox sh -c 'truncate -s 5M somefile; truncate -s 5M /volume/file' \
&& docker tag busybox:latest image_$i; \
done;
docker pull alpine
docker pull nginx:alpine
echo -e "FROM busybox\nRUN truncate -s 50M bigfile" | DOCKER_BUILDKIT=1 docker build -
Start listening for "prune" events in another shell:
docker events --filter event=prune
Prune containers, networks, volumes, and build-cache:
docker system prune -af --volumes
See the events that are returned:
docker events --filter event=prune
2020-07-25T12:12:09.268491000Z container prune (reclaimed=15728640)
2020-07-25T12:12:09.447890400Z network prune (reclaimed=0)
2020-07-25T12:12:09.452323000Z volume prune (reclaimed=15728640)
2020-07-25T12:12:09.517236200Z image prune (reclaimed=21568540)
2020-07-25T12:12:09.566662600Z builder prune (reclaimed=52428841)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-07-25 12:14:38 +00:00
bb , err := buildbackend . NewBackend ( d . ImageService ( ) , manager , bk , d . EventsService )
2017-06-12 21:50:29 +00:00
if err != nil {
return opts , errors . Wrap ( err , "failed to create buildmanager" )
}
return routerOptions {
sessionManager : sm ,
buildBackend : bb ,
2018-08-06 01:52:35 +00:00
buildkit : bk ,
2018-09-06 18:50:41 +00:00
features : d . Features ( ) ,
daemon : d ,
2017-06-12 21:50:29 +00:00
} , nil
}
2016-04-23 00:16:14 +00:00
func ( cli * DaemonCli ) reloadConfig ( ) {
2018-04-23 19:24:01 +00:00
reload := func ( c * config . Config ) {
2016-05-16 18:12:48 +00:00
2016-10-31 20:14:00 +00:00
// Revalidate and reload the authorization plugins
2018-04-23 19:24:01 +00:00
if err := validateAuthzPlugins ( c . AuthorizationPlugins , cli . d . PluginStore ) ; err != nil {
2016-10-31 20:14:00 +00:00
logrus . Fatalf ( "Error validating authorization plugin: %v" , err )
return
}
2018-04-23 19:24:01 +00:00
cli . authzMiddleware . SetPlugins ( c . AuthorizationPlugins )
if err := cli . d . Reload ( c ) ; err != nil {
2016-04-23 00:16:14 +00:00
logrus . Errorf ( "Error reconfiguring the daemon: %v" , err )
return
}
2016-05-16 18:12:48 +00:00
2018-04-23 19:24:01 +00:00
if c . IsValueSet ( "debug" ) {
2016-12-12 08:33:58 +00:00
debugEnabled := debug . IsEnabled ( )
2016-04-23 00:16:14 +00:00
switch {
2018-04-23 19:24:01 +00:00
case debugEnabled && ! c . Debug : // disable debug
2016-12-12 08:33:58 +00:00
debug . Disable ( )
2018-04-23 19:24:01 +00:00
case c . Debug && ! debugEnabled : // enable debug
2016-12-12 08:33:58 +00:00
debug . Enable ( )
2015-04-27 21:11:29 +00:00
}
}
2015-03-11 14:33:06 +00:00
}
2016-04-23 00:16:14 +00:00
2017-01-23 11:23:07 +00:00
if err := config . Reload ( * cli . configFile , cli . flags , reload ) ; err != nil {
2016-04-23 00:16:14 +00:00
logrus . Error ( err )
}
}
func ( cli * DaemonCli ) stop ( ) {
cli . api . Close ( )
2014-08-01 17:34:06 +00:00
}
2015-03-29 19:48:52 +00:00
2015-04-27 21:11:29 +00:00
// shutdownDaemon just wraps daemon.Shutdown() to handle a timeout in case
// d.Shutdown() is waiting too long to kill container or worst it's
// blocked there
2016-06-07 03:29:05 +00:00
func shutdownDaemon ( d * daemon . Daemon ) {
shutdownTimeout := d . ShutdownTimeout ( )
2015-04-27 21:11:29 +00:00
ch := make ( chan struct { } )
go func ( ) {
2015-09-29 17:51:40 +00:00
d . Shutdown ( )
2015-04-27 21:11:29 +00:00
close ( ch )
} ( )
2016-06-07 03:29:05 +00:00
if shutdownTimeout < 0 {
<- ch
logrus . Debug ( "Clean shutdown succeeded" )
return
}
2019-01-09 18:24:03 +00:00
timeout := time . NewTimer ( time . Duration ( shutdownTimeout ) * time . Second )
defer timeout . Stop ( )
2015-04-27 21:11:29 +00:00
select {
case <- ch :
2015-08-07 22:24:18 +00:00
logrus . Debug ( "Clean shutdown succeeded" )
2019-01-09 18:24:03 +00:00
case <- timeout . C :
2015-04-27 21:11:29 +00:00
logrus . Error ( "Force shutdown daemon" )
}
}
2015-12-10 23:35:10 +00:00
2017-06-01 20:34:31 +00:00
func loadDaemonCliConfig ( opts * daemonOptions ) ( * config . Config , error ) {
2017-01-23 11:23:07 +00:00
conf := opts . daemonConfig
2016-06-21 20:42:47 +00:00
flags := opts . flags
2017-06-01 20:34:31 +00:00
conf . Debug = opts . Debug
conf . Hosts = opts . Hosts
conf . LogLevel = opts . LogLevel
2020-07-28 23:01:08 +00:00
if opts . flags . Changed ( FlagTLS ) {
conf . TLS = & opts . TLS
}
if opts . flags . Changed ( FlagTLSVerify ) {
conf . TLSVerify = & opts . TLSVerify
v := true
conf . TLS = & v
}
2017-01-23 11:23:07 +00:00
conf . CommonTLSOptions = config . CommonTLSOptions { }
2015-12-10 23:35:10 +00:00
2017-06-01 20:34:31 +00:00
if opts . TLSOptions != nil {
conf . CommonTLSOptions . CAFile = opts . TLSOptions . CAFile
conf . CommonTLSOptions . CertFile = opts . TLSOptions . CertFile
conf . CommonTLSOptions . KeyFile = opts . TLSOptions . KeyFile
2015-12-10 23:35:10 +00:00
}
2019-06-18 00:23:44 +00:00
if conf . TrustKeyPath == "" {
daemonConfDir , err := getDaemonConfDir ( conf . Root )
if err != nil {
return nil , err
}
conf . TrustKeyPath = filepath . Join ( daemonConfDir , defaultTrustKeyFile )
}
2017-03-28 14:19:35 +00:00
if flags . Changed ( "graph" ) && flags . Changed ( "data-root" ) {
2018-08-22 14:00:22 +00:00
return nil , errors . New ( ` cannot specify both "--graph" and "--data-root" option ` )
2017-03-28 14:19:35 +00:00
}
2016-06-21 20:42:47 +00:00
if opts . configFile != "" {
2017-01-23 11:23:07 +00:00
c , err := config . MergeDaemonConfigurations ( conf , flags , opts . configFile )
2015-12-10 23:35:10 +00:00
if err != nil {
2017-03-30 10:01:00 +00:00
if flags . Changed ( "config-file" ) || ! os . IsNotExist ( err ) {
2018-08-22 14:00:22 +00:00
return nil , errors . Wrapf ( err , "unable to configure the Docker daemon with file %s" , opts . configFile )
2015-12-10 23:35:10 +00:00
}
}
2020-07-28 23:01:08 +00:00
2015-12-10 23:35:10 +00:00
// the merged configuration can be nil if the config file didn't exist.
// leave the current configuration as it is if when that happens.
if c != nil {
2017-01-23 11:23:07 +00:00
conf = c
2015-12-10 23:35:10 +00:00
}
}
2017-01-23 11:23:07 +00:00
if err := config . Validate ( conf ) ; err != nil {
2016-05-23 21:49:50 +00:00
return nil , err
}
2017-03-28 14:19:35 +00:00
if flags . Changed ( "graph" ) {
2017-06-11 12:39:28 +00:00
logrus . Warnf ( ` The "-g / --graph" flag is deprecated. Please use "--data-root" instead ` )
2017-03-28 14:19:35 +00:00
}
2017-11-12 02:09:28 +00:00
// Check if duplicate label-keys with different values are found
newLabels , err := config . GetConflictFreeLabels ( conf . Labels )
if err != nil {
return nil , err
2016-07-12 12:08:05 +00:00
}
2017-11-12 02:09:28 +00:00
conf . Labels = newLabels
2016-07-12 12:08:05 +00:00
2016-01-19 19:16:07 +00:00
// Regardless of whether the user sets it to true or false, if they
// specify TLSVerify at all then we need to turn on TLS
2017-06-01 20:34:31 +00:00
if conf . IsValueSet ( FlagTLSVerify ) {
2020-07-28 23:01:08 +00:00
v := true
conf . TLS = & v
}
if conf . TLSVerify == nil && conf . TLS != nil {
conf . TLSVerify = conf . TLS
2016-01-19 19:16:07 +00:00
}
2022-01-06 21:20:15 +00:00
err = validateCPURealtimeOptions ( conf )
if err != nil {
return nil , err
}
2017-01-23 11:23:07 +00:00
return conf , nil
2015-12-10 23:35:10 +00:00
}
2016-02-10 20:16:59 +00:00
2021-12-15 22:51:57 +00:00
func checkDeprecatedOptions ( config * config . Config ) error {
// Overlay networks with external k/v stores have been deprecated
if config . ClusterAdvertise != "" || len ( config . ClusterOpts ) > 0 || config . ClusterStore != "" {
return errors . New ( "Host-discovery and overlay networks with external k/v stores are deprecated. The 'cluster-advertise', 'cluster-store', and 'cluster-store-opt' options have been removed" )
2020-02-12 17:29:30 +00:00
}
2021-12-15 22:51:57 +00:00
return nil
2020-02-12 17:29:30 +00:00
}
2017-06-12 21:50:29 +00:00
func initRouter ( opts routerOptions ) {
2020-03-10 12:09:25 +00:00
decoder := runconfig . ContainerDecoder {
GetSysInfo : func ( ) * sysinfo . SysInfo {
2021-07-14 14:45:02 +00:00
return opts . daemon . RawSysInfo ( )
2020-03-10 12:09:25 +00:00
} ,
}
2016-03-28 18:22:23 +00:00
2016-11-17 01:58:06 +00:00
routers := [ ] router . Router {
// we need to add the checkpoint router before the container router or the DELETE gets masked
2017-06-12 21:50:29 +00:00
checkpointrouter . NewRouter ( opts . daemon , decoder ) ,
2021-07-14 14:45:02 +00:00
container . NewRouter ( opts . daemon , decoder , opts . daemon . RawSysInfo ( ) . CgroupUnified ) ,
2018-02-02 22:18:46 +00:00
image . NewRouter ( opts . daemon . ImageService ( ) ) ,
2019-09-24 21:37:38 +00:00
systemrouter . NewRouter ( opts . daemon , opts . cluster , opts . buildkit , opts . features ) ,
2018-03-22 21:11:03 +00:00
volume . NewRouter ( opts . daemon . VolumesService ( ) ) ,
2018-08-22 06:05:26 +00:00
build . NewRouter ( opts . buildBackend , opts . daemon , opts . features ) ,
2017-06-12 21:50:29 +00:00
sessionrouter . NewRouter ( opts . sessionManager ) ,
swarmrouter . NewRouter ( opts . cluster ) ,
pluginrouter . NewRouter ( opts . daemon . PluginManager ( ) ) ,
2018-02-02 22:18:46 +00:00
distributionrouter . NewRouter ( opts . daemon . ImageService ( ) ) ,
2016-11-17 01:58:06 +00:00
}
2016-08-30 14:10:44 +00:00
2019-04-02 04:08:51 +00:00
grpcBackends := [ ] grpcrouter . Backend { }
for _ , b := range [ ] interface { } { opts . daemon , opts . buildBackend } {
if b , ok := b . ( grpcrouter . Backend ) ; ok {
grpcBackends = append ( grpcBackends , b )
}
}
if len ( grpcBackends ) > 0 {
routers = append ( routers , grpcrouter . NewRouter ( grpcBackends ... ) )
}
2017-06-12 21:50:29 +00:00
if opts . daemon . NetworkControllerEnabled ( ) {
routers = append ( routers , network . NewRouter ( opts . daemon , opts . cluster ) )
Remove static errors from errors package.
Moving all strings to the errors package wasn't a good idea after all.
Our custom implementation of Go errors predates everything that's nice
and good about working with errors in Go. Take as an example what we
have to do to get an error message:
```go
func GetErrorMessage(err error) string {
switch err.(type) {
case errcode.Error:
e, _ := err.(errcode.Error)
return e.Message
case errcode.ErrorCode:
ec, _ := err.(errcode.ErrorCode)
return ec.Message()
default:
return err.Error()
}
}
```
This goes against every good practice for Go development. The language already provides a simple, intuitive and standard way to get error messages, that is calling the `Error()` method from an error. Reinventing the error interface is a mistake.
Our custom implementation also makes very hard to reason about errors, another nice thing about Go. I found several (>10) error declarations that we don't use anywhere. This is a clear sign about how little we know about the errors we return. I also found several error usages where the number of arguments was different than the parameters declared in the error, another clear example of how difficult is to reason about errors.
Moreover, our custom implementation didn't really make easier for people to return custom HTTP status code depending on the errors. Again, it's hard to reason about when to set custom codes and how. Take an example what we have to do to extract the message and status code from an error before returning a response from the API:
```go
switch err.(type) {
case errcode.ErrorCode:
daError, _ := err.(errcode.ErrorCode)
statusCode = daError.Descriptor().HTTPStatusCode
errMsg = daError.Message()
case errcode.Error:
// For reference, if you're looking for a particular error
// then you can do something like :
// import ( derr "github.com/docker/docker/errors" )
// if daError.ErrorCode() == derr.ErrorCodeNoSuchContainer { ... }
daError, _ := err.(errcode.Error)
statusCode = daError.ErrorCode().Descriptor().HTTPStatusCode
errMsg = daError.Message
default:
// This part of will be removed once we've
// converted everything over to use the errcode package
// FIXME: this is brittle and should not be necessary.
// If we need to differentiate between different possible error types,
// we should create appropriate error types with clearly defined meaning
errStr := strings.ToLower(err.Error())
for keyword, status := range map[string]int{
"not found": http.StatusNotFound,
"no such": http.StatusNotFound,
"bad parameter": http.StatusBadRequest,
"conflict": http.StatusConflict,
"impossible": http.StatusNotAcceptable,
"wrong login/password": http.StatusUnauthorized,
"hasn't been activated": http.StatusForbidden,
} {
if strings.Contains(errStr, keyword) {
statusCode = status
break
}
}
}
```
You can notice two things in that code:
1. We have to explain how errors work, because our implementation goes against how easy to use Go errors are.
2. At no moment we arrived to remove that `switch` statement that was the original reason to use our custom implementation.
This change removes all our status errors from the errors package and puts them back in their specific contexts.
IT puts the messages back with their contexts. That way, we know right away when errors used and how to generate their messages.
It uses custom interfaces to reason about errors. Errors that need to response with a custom status code MUST implementent this simple interface:
```go
type errorWithStatus interface {
HTTPErrorStatusCode() int
}
```
This interface is very straightforward to implement. It also preserves Go errors real behavior, getting the message is as simple as using the `Error()` method.
I included helper functions to generate errors that use custom status code in `errors/errors.go`.
By doing this, we remove the hard dependency we have eeverywhere to our custom errors package. Yes, you can use it as a helper to generate error, but it's still very easy to generate errors without it.
Please, read this fantastic blog post about errors in Go: http://dave.cheney.net/2014/12/24/inspecting-errors
Signed-off-by: David Calavera <david.calavera@gmail.com>
2016-02-25 15:53:35 +00:00
}
2017-06-12 21:50:29 +00:00
if opts . daemon . HasExperimental ( ) {
2016-11-17 01:58:06 +00:00
for _ , r := range routers {
for _ , route := range r . Routes ( ) {
if experimental , ok := route . ( router . ExperimentalRoute ) ; ok {
experimental . Enable ( )
}
}
}
}
2017-04-08 18:43:42 +00:00
opts . api . InitRouter ( routers ... )
2016-02-10 20:16:59 +00:00
}
2016-04-08 23:22:39 +00:00
2017-06-12 21:50:29 +00:00
// TODO: remove this from cli and return the authzMiddleware
2017-08-23 22:21:41 +00:00
func ( cli * DaemonCli ) initMiddlewares ( s * apiserver . Server , cfg * apiserver . Config , pluginStore plugingetter . PluginGetter ) error {
2016-04-19 14:56:54 +00:00
v := cfg . Version
2016-04-08 23:22:39 +00:00
2017-03-17 21:57:23 +00:00
exp := middleware . NewExperimentalMiddleware ( cli . Config . Experimental )
2016-10-06 14:09:54 +00:00
s . UseMiddleware ( exp )
2016-04-08 23:22:39 +00:00
vm := middleware . NewVersionMiddleware ( v , api . DefaultVersion , api . MinVersion )
s . UseMiddleware ( vm )
2017-09-12 10:43:34 +00:00
if cfg . CorsHeaders != "" {
2016-04-08 23:22:39 +00:00
c := middleware . NewCORSMiddleware ( cfg . CorsHeaders )
s . UseMiddleware ( c )
}
2017-03-17 21:57:23 +00:00
cli . authzMiddleware = authorization . NewMiddleware ( cli . Config . AuthorizationPlugins , pluginStore )
cli . Config . AuthzMiddleware = cli . authzMiddleware
2016-05-16 18:12:48 +00:00
s . UseMiddleware ( cli . authzMiddleware )
2016-10-31 20:14:00 +00:00
return nil
}
2018-05-23 19:15:21 +00:00
func ( cli * DaemonCli ) getContainerdDaemonOpts ( ) ( [ ] supervisor . DaemonOpt , error ) {
opts , err := cli . getPlatformContainerdDaemonOpts ( )
2017-09-22 13:52:41 +00:00
if err != nil {
return nil , err
}
2018-05-23 19:15:21 +00:00
if cli . Config . Debug {
opts = append ( opts , supervisor . WithLogLevel ( "debug" ) )
} else if cli . Config . LogLevel != "" {
opts = append ( opts , supervisor . WithLogLevel ( cli . Config . LogLevel ) )
}
if ! cli . Config . CriContainerd {
opts = append ( opts , supervisor . WithPlugin ( "cri" , nil ) )
}
2017-09-22 13:52:41 +00:00
return opts , nil
}
2018-04-12 18:44:20 +00:00
func newAPIServerConfig ( cli * DaemonCli ) ( * apiserver . Config , error ) {
serverConfig := & apiserver . Config {
Logging : true ,
SocketGroup : cli . Config . SocketGroup ,
Version : dockerversion . Version ,
CorsHeaders : cli . Config . CorsHeaders ,
}
2020-07-28 23:01:08 +00:00
if cli . Config . TLS != nil && * cli . Config . TLS {
2018-04-12 18:44:20 +00:00
tlsOptions := tlsconfig . Options {
CAFile : cli . Config . CommonTLSOptions . CAFile ,
CertFile : cli . Config . CommonTLSOptions . CertFile ,
KeyFile : cli . Config . CommonTLSOptions . KeyFile ,
ExclusiveRootPools : true ,
}
2020-07-28 23:01:08 +00:00
if cli . Config . TLSVerify == nil || * cli . Config . TLSVerify {
2018-04-12 18:44:20 +00:00
// server requires and verifies client's certificate
tlsOptions . ClientAuth = tls . RequireAndVerifyClientCert
}
tlsConfig , err := tlsconfig . Server ( tlsOptions )
if err != nil {
return nil , err
}
serverConfig . TLSConfig = tlsConfig
}
if len ( cli . Config . Hosts ) == 0 {
cli . Config . Hosts = make ( [ ] string , 1 )
}
return serverConfig , nil
}
2020-07-28 23:01:08 +00:00
// checkTLSAuthOK checks basically for an explicitly disabled TLS/TLSVerify
// Going forward we do not want to support a scenario where dockerd listens
// on TCP without either TLS client auth (or an explicit opt-in to disable it)
func checkTLSAuthOK ( c * config . Config ) bool {
if c . TLS == nil {
// Either TLS is enabled by default, in which case TLS verification should be enabled by default, or explicitly disabled
// Or TLS is disabled by default... in any of these cases, we can just take the default value as to how to proceed
return DefaultTLSValue
}
if ! * c . TLS {
// TLS is explicitly disabled, which is supported
return true
}
if c . TLSVerify == nil {
// this actually shouldn't happen since we set TLSVerify on the config object anyway
// But in case it does get here, be cautious and assume this is not supported.
return false
}
// Either TLSVerify is explicitly enabled or disabled, both cases are supported
return true
}
2018-04-12 18:44:20 +00:00
func loadListeners ( cli * DaemonCli , serverConfig * apiserver . Config ) ( [ ] string , error ) {
var hosts [ ] string
2019-07-12 23:53:12 +00:00
seen := make ( map [ string ] struct { } , len ( cli . Config . Hosts ) )
2020-07-28 23:01:08 +00:00
useTLS := DefaultTLSValue
if cli . Config . TLS != nil {
useTLS = * cli . Config . TLS
}
2018-04-12 18:44:20 +00:00
for i := 0 ; i < len ( cli . Config . Hosts ) ; i ++ {
var err error
2020-07-28 23:01:08 +00:00
if cli . Config . Hosts [ i ] , err = dopts . ParseHost ( useTLS , honorXDG , cli . Config . Hosts [ i ] ) ; err != nil {
2018-08-22 14:00:22 +00:00
return nil , errors . Wrapf ( err , "error parsing -H %s" , cli . Config . Hosts [ i ] )
2018-04-12 18:44:20 +00:00
}
2019-07-12 23:53:12 +00:00
if _ , ok := seen [ cli . Config . Hosts [ i ] ] ; ok {
continue
}
seen [ cli . Config . Hosts [ i ] ] = struct { } { }
2018-04-12 18:44:20 +00:00
protoAddr := cli . Config . Hosts [ i ]
protoAddrParts := strings . SplitN ( protoAddr , "://" , 2 )
if len ( protoAddrParts ) != 2 {
return nil , fmt . Errorf ( "bad format %s, expected PROTO://ADDR" , protoAddr )
}
proto := protoAddrParts [ 0 ]
addr := protoAddrParts [ 1 ]
// It's a bad idea to bind to TCP without tlsverify.
2020-07-28 23:01:08 +00:00
authEnabled := serverConfig . TLSConfig != nil && serverConfig . TLSConfig . ClientAuth == tls . RequireAndVerifyClientCert
if proto == "tcp" && ! authEnabled {
logrus . WithField ( "host" , protoAddr ) . Warn ( "Binding to IP address without --tlsverify is insecure and gives root access on this machine to everyone who has access to your network." )
logrus . WithField ( "host" , protoAddr ) . Warn ( "Binding to an IP address, even on localhost, can also give access to scripts run in a browser. Be safe out there!" )
time . Sleep ( time . Second )
// If TLSVerify is explicitly set to false we'll take that as "Please let me shoot myself in the foot"
// We do not want to continue to support a default mode where tls verification is disabled, so we do some extra warnings here and eventually remove support
if ! checkTLSAuthOK ( cli . Config ) {
ipAddr , _ , err := net . SplitHostPort ( addr )
if err != nil {
return nil , errors . Wrap ( err , "error parsing tcp address" )
}
// shortcut all this extra stuff for literal "localhost"
// -H supports specifying hostnames, since we want to bypass this on loopback interfaces we'll look it up here.
if ipAddr != "localhost" {
ip := net . ParseIP ( ipAddr )
if ip == nil {
ipA , err := net . ResolveIPAddr ( "ip" , ipAddr )
if err != nil {
logrus . WithError ( err ) . WithField ( "host" , ipAddr ) . Error ( "Error looking up specified host address" )
}
if ipA != nil {
ip = ipA . IP
}
}
if ip == nil || ! ip . IsLoopback ( ) {
logrus . WithField ( "host" , protoAddr ) . Warn ( "Binding to an IP address without --tlsverify is deprecated. Startup is intentionally being slowed down to show this message" )
logrus . WithField ( "host" , protoAddr ) . Warn ( "Please consider generating tls certificates with client validation to prevent exposing unauthenticated root access to your network" )
logrus . WithField ( "host" , protoAddr ) . Warnf ( "You can override this by explicitly specifying '--%s=false' or '--%s=false'" , FlagTLS , FlagTLSVerify )
logrus . WithField ( "host" , protoAddr ) . Warnf ( "Support for listening on TCP without authentication or explicit intent to run without authentication will be removed in the next release" )
time . Sleep ( 15 * time . Second )
}
}
}
2018-04-12 18:44:20 +00:00
}
ls , err := listeners . Init ( proto , addr , serverConfig . SocketGroup , serverConfig . TLSConfig )
if err != nil {
return nil , err
}
// If we're binding to a TCP port, make sure that a container doesn't try to use it.
if proto == "tcp" {
if err := allocateDaemonPort ( addr ) ; err != nil {
return nil , err
}
}
logrus . Debugf ( "Listener created for HTTP on %s (%s)" , proto , addr )
hosts = append ( hosts , protoAddrParts [ 1 ] )
cli . api . Accept ( addr , ls ... )
}
return hosts , nil
}
func createAndStartCluster ( cli * DaemonCli , d * daemon . Daemon ) ( * cluster . Cluster , error ) {
name , _ := os . Hostname ( )
// Use a buffered channel to pass changes from store watch API to daemon
// A buffer allows store watch API and daemon processing to not wait for each other
watchStream := make ( chan * swarmapi . WatchMessage , 32 )
c , err := cluster . New ( cluster . Config {
Root : cli . Config . Root ,
Name : name ,
Backend : d ,
2018-03-22 21:11:03 +00:00
VolumeBackend : d . VolumesService ( ) ,
2018-04-12 18:44:20 +00:00
ImageBackend : d . ImageService ( ) ,
PluginBackend : d . PluginManager ( ) ,
NetworkSubnetsProvider : d ,
DefaultAdvertiseAddr : cli . Config . SwarmDefaultAdvertiseAddr ,
RaftHeartbeatTick : cli . Config . SwarmRaftHeartbeatTick ,
RaftElectionTick : cli . Config . SwarmRaftElectionTick ,
RuntimeRoot : cli . getSwarmRunRoot ( ) ,
WatchStream : watchStream ,
} )
if err != nil {
return nil , err
}
d . SetCluster ( c )
err = c . Start ( )
return c , err
}
2016-10-31 20:14:00 +00:00
// validates that the plugins requested with the --authorization-plugin flag are valid AuthzDriver
// plugins present on the host and available to the daemon
func validateAuthzPlugins ( requestedPlugins [ ] string , pg plugingetter . PluginGetter ) error {
for _ , reqPlugin := range requestedPlugins {
2016-12-20 02:18:43 +00:00
if _ , err := pg . Get ( reqPlugin , authorization . AuthZApiImplements , plugingetter . Lookup ) ; err != nil {
2016-10-31 20:14:00 +00:00
return err
}
}
return nil
2016-04-08 23:22:39 +00:00
}
2018-09-21 22:58:34 +00:00
2019-04-19 07:53:58 +00:00
func systemContainerdRunning ( honorXDG bool ) ( string , bool , error ) {
2018-10-15 07:52:53 +00:00
addr := containerddefaults . DefaultAddress
2019-04-19 07:53:58 +00:00
if honorXDG {
2018-10-15 07:52:53 +00:00
runtimeDir , err := homedir . GetRuntimeDir ( )
if err != nil {
return "" , false , err
}
addr = filepath . Join ( runtimeDir , "containerd" , "containerd.sock" )
}
_ , err := os . Lstat ( addr )
return addr , err == nil , nil
2018-09-21 22:58:34 +00:00
}
2018-11-24 13:39:08 +00:00
// configureDaemonLogs sets the logrus logging level and formatting
func configureDaemonLogs ( conf * config . Config ) error {
if conf . LogLevel != "" {
lvl , err := logrus . ParseLevel ( conf . LogLevel )
if err != nil {
return fmt . Errorf ( "unable to parse logging level: %s" , conf . LogLevel )
}
logrus . SetLevel ( lvl )
} else {
logrus . SetLevel ( logrus . InfoLevel )
}
logrus . SetFormatter ( & logrus . TextFormatter {
TimestampFormat : jsonmessage . RFC3339NanoFixed ,
DisableColors : conf . RawLogs ,
FullTimestamp : true ,
} )
return nil
}
2021-07-16 07:33:00 +00:00
func configureProxyEnv ( conf * config . Config ) {
if p := conf . HTTPProxy ; p != "" {
overrideProxyEnv ( "HTTP_PROXY" , p )
overrideProxyEnv ( "http_proxy" , p )
}
if p := conf . HTTPSProxy ; p != "" {
overrideProxyEnv ( "HTTPS_PROXY" , p )
overrideProxyEnv ( "https_proxy" , p )
}
if p := conf . NoProxy ; p != "" {
overrideProxyEnv ( "NO_PROXY" , p )
overrideProxyEnv ( "no_proxy" , p )
}
}
func overrideProxyEnv ( name , val string ) {
if oldVal := os . Getenv ( name ) ; oldVal != "" && oldVal != val {
logrus . WithFields ( logrus . Fields {
"name" : name ,
2021-08-31 12:13:30 +00:00
"old-value" : config . MaskCredentials ( oldVal ) ,
"new-value" : config . MaskCredentials ( val ) ,
2021-07-16 07:33:00 +00:00
} ) . Warn ( "overriding existing proxy variable with value from configuration" )
}
_ = os . Setenv ( name , val )
}